Ethereal-users: Re: [Ethereal-users] size limit of trace file?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 8 Jan 2001 15:15:15 -0800 (PST)
> Dose anyone know about the upper limit of the trace file size?

There is no single fixed upper limit.

There may be limits imposed by:

	the OS running on the machine on which you're running Ethereal;

	the OS running on the machine on which the trace file is stored;

	the OS running on the machine on which you are doing the
	capture.

Ethereal currently uses a "long" as an offset in the file, which imposes
a limit of 2^31-1 bytes on systems with 32-bit "long"s and a limit of
2^64-1 bytes on systems with 64-bit "long"s (the latter limit is very
high, but other limits in the OS will probably be lower than that).

In addition, the amount of memory Ethereal requires to read a capture
file increases the larger the capture file is (it requires a data
structure for each packet, *and* the widget used to display the list of
packets stores a copy of the string in each of the columns for each of
the packets), which may also limit the size of the file you can read
with Ethereal - but that's not a simple fixed limit, it depends on how
much memory your machine has, how much swap space/pagefile
space/whatever your OS calls the backing store for anonymous pages space
your machine has, details of your OS, etc..